topic field extraction trouble with forwarders in Splunk Search

field extraction trouble with forwarders

jhedgpeth — Sat, 30 Oct 2010 22:56:05 GMT

I'm really frustrated and need a sanity check on what I'm doing. I've got an indexer which is deploying apps to several heavy forwarders. Each app has inputs, props and transforms for specific server type data. The inputs and props are working great, however I can't get any field extraction to show up on the indexer.

One example:

props.conf ------

[stellent_log]
TRANSFORMS-stellent = stellent_setnull, stellent_keep   *(these work)*
REPORT-verbose = verbose_status
REPORT-heap = heap_status
TIME_FORMAT = %m.%d %H:%M:%S.%3N

transforms.conf ------

[verbose_status]
REGEX = Configuring tracing verbose:\s+(\w+):
FORMAT = verbose_status::$1

[heap_status]
REGEX = (?i)are\s+(?<heapfree>\d+)\s+free[^\d]+\s+(?<heaptotal>\d+)\s+meg

I've read http://www.splunk.com/wiki/Where_do_I_configure_my_Splunk_settings%3F (may not have understood this fully)
Tested the regex at regexpal.com
Copied the transform to $SPLUNK_HOME/etc/system/local/ to see if it was in the wrong place
Extracted fields using the same regex from the WebUI which saved in $SPLUNK_HOME/etc/users/admin/search/local (worked)

The only field extraction I have working is from conf files local to the indexer. Am I making a simple mistake?

Re: field extraction trouble with forwarders

gkanapathy — Sat, 30 Oct 2010 23:41:20 GMT

All search-time extractions must be defined on the search head (which appears to be the same as the indexer in your case).

Re: field extraction trouble with forwarders

gkanapathy — Sat, 30 Oct 2010 23:42:34 GMT

Also, unless you have a good specific reason for doing otherwise, it's recommended that you use light forwarders rather than heavy.

Re: field extraction trouble with forwarders

jhedgpeth — Sat, 30 Oct 2010 23:54:53 GMT

Thanks for responding. You're right about the indexer/search combo. Since I'm preparing this for my users and I already know the data, I was trying to config this ahead of time (which I thought was non-search-time), or is there only "search-time" extraction? On the other point, do you know where I'd find info to make an educated choice about light/heavy forwarders? My main factor now was that I'm configuring not to forward GBs of data that I can't afford. thanks!

Re: field extraction trouble with forwarders

gkanapathy — Sun, 31 Oct 2010 13:54:43 GMT

The article about "where do I configure my settings" is fairly explicit about which settings are search-time (and therefore on the search head) and which are input-time or parse-time. If you don't know specifically that you should use a heavy forwarder, then you should use a light forwarder.